Identity and Access Management

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Which THREE actions are best practices for managing root user account security? (Select THREE)

A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?

A security engineer is troubleshooting an IAM policy evaluation issue where an explicit deny statement inside a permissions boundary is failing to restrict permissions as expected for a developer role. Which TWO factors must the engineer verify during the evaluation process?

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?

A company is using AWS IAM Identity Center (successor to AWS Single Sign-On) to manage access to their AWS accounts. They want to automate the process of adding and removing users based on their status in an external identity provider. Which protocol should they use?

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

A company is building a mobile application that requires users to authenticate before accessing private data stored in Amazon S3 and Amazon DynamoDB. Which THREE components or features of Amazon Cognito should be used to implement this securely?

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

A security engineer is tasked with granting a developer in Account A access to an Amazon S3 bucket located in Account B. The developer needs to perform PutObject and GetObject operations. According to security best practices for cross-account access, which configuration provides the most secure and manageable solution?

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

An application running on an Amazon EC2 instance needs to access files in an Amazon S3 bucket. What is the most secure way to provide the application with the necessary credentials?

A security team wants to identify which IAM roles in their AWS account have been granted permissions that allow access from external AWS accounts or public entities. Which AWS service should they use to automate this audit?